{"id":"SUSE-SU-2026:3225-1","summary":"Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni","details":"This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue\n\nSecurity issues fixed:\n\n- CVE-2026-26032: improper pathname limitation in `PackagerResolver` allows for arbitrary files writes outside of the\n  configured `buildRoot` directory (bsc#1271727).\n\nOther updates and bugfixes:\n\n- Update `apache-commons-compress` to 1.28.0.\n- Update `apache-ivy` to 2.6.0.\n- Include `brotli-java` and update to 1.2.0.\n- Include `zstd-jni` and update to v1.5.7.11.\n","modified":"2026-07-24T17:16:04.995917478Z","published":"2026-07-23T18:36:40Z","related":["CVE-2026-26032"],"upstream":["CVE-2026-26032"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263225-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269480"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271727"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-26032"}],"affected":[{"package":{"name":"apache-commons-compress","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/apache-commons-compress&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.19.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-compress":"1.28.0-150200.3.19.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3225-1.json"}},{"package":{"name":"apache-ivy","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","purl":"pkg:rpm/suse/apache-ivy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150200.3.12.1"}]}],"ecosystem_specific":{"binaries":[{"apache-ivy":"2.6.0-150200.3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3225-1.json"}}],"schema_version":"1.7.5"}